Programming

Grounding-DINO: A Zero-Shot AI Object Detector You Can Query With Text

Grounding-DINO is an open-set, zero-shot object detection model that identifies and localizes objects in images using plain-text prompts, without requiring task-specific retraining. Maintained by Hautechai on Replicate, the model runs on an H100 build and accepts an image alongside a comma-separated list of object names, returning detected regions with bounding boxes. It achieves 52.5 AP on zero-shot COCO benchmarks and 63.0 AP after fine-tuning, making it competitive for open-vocabulary detection tasks. Practical use cases include dataset annotation, visual inspection prototyping, image search, and serving as a localization step before segmentation or tracking pipelines. Users should note that results are sensitive to prompt wording and threshold settings, and outputs should be treated as proposals requiring human review rather than production-ready detections.

What California is learning from solar panels built over irrigation canals

Article URL: https://www.kqed.org/science/2002033/heres-what-california-is-learning-from-solar-panels-built-over-irrigation-canals Comments URL: https://news.ycombinator.com/item?id=49796379 Points: 161 # Comments: 249

I Built a 4K Screen Recorder That Runs Entirely in the Browser — Here's How#webdev #javascript #showdev #opensource

350 'I Would Pay' Comments on Hacker News, 30 Days: Zero Actual Buyers

A systematic 30-day scan of Hacker News comments using the Algolia API tracked 350 unique instances of phrases like 'willing to pay' and 'take my money' from 323 distinct authors. After deduplication, only 26 of those authors had a publicly listed email address in their profiles. Of all 350 comments, just one contained a concrete, actionable product request — for a bulk Wayback Machine domain downloader. The remaining 349 comments were largely rhetorical, used in arguments about pricing, streaming services, or ads rather than expressing genuine purchase intent. The findings suggest that 'I would pay' on public forums is almost never a real signal of customer demand.

restore-verified fixes 3 gaps in file-mutation safety that try/finally misses

A developer has released restore-verified, a Python and JavaScript package designed to reliably restore source files after intentional mutation during testing or benchmarking. Standard try/finally blocks only guard against mid-run exceptions, leaving files broken after SIGTERM signals, SIGKILL timeouts, or silent restore failures. The package addresses these gaps by snapshotting files before mutation, verifying byte-for-byte restoration afterward, and providing an external sentinel for SIGKILL scenarios where in-process guards cannot run. Snapshots are stored in a temp directory rather than alongside source files to avoid skewing file-walker results. The tool ships with a CLI that exits with a distinct code of 3 when a restore was needed or failed, signaling that the run should not be trusted even if recovery succeeded.

Developer Packages Google ADK Coding Lessons into Reusable Agent Skills

A developer repeatedly found themselves explaining the same requirements to coding assistants when building Google ADK applications on Google Cloud. To address this, they compiled their hands-on lessons into a reusable collection of skills for AI agent development. The collection covers areas including guardrails, deployment, memory management, security, evaluation, and front-end integration. All skills are based on working examples the developer personally built and tested. The creator is inviting feedback and encouraging others to try the skills and report gaps in assistant behavior.

Agentic AI Cost Overruns Stem From Unmeasured Steps, Not Expensive Models

A software team burned through a month's AI budget in just three days, revealing a systemic problem in how agentic pipelines allocate model usage. The root cause was not the high cost of frontier models but the absence of per-step attribution, meaning every task — from simple classification to complex reasoning — defaulted silently to the most expensive model. Without logging each step's model, token count, latency, and retry activity, engineers were optimizing blindly, typically by downgrading models across the board and sacrificing quality where it mattered. Analysis showed that roughly 80% of frontier model calls were on tasks a smaller model could have handled equally well. The fix requires instrumenting every step individually and building failover logic at the step level, so a single failing call triggers a targeted model swap rather than a costly full-pipeline retry.

Tens of Thousands of Data Pipeline Services Exposed Publicly, Scan Finds

A ZoomEye scan conducted on 22 September 2026 found over 45,000 ClickHouse instances, nearly 16,000 Cassandra nodes, and thousands of InfluxDB, MQTT, and Elasticsearch services reachable on public interfaces. Many of these services — including ClickHouse and older InfluxDB deployments — do not require authentication by default, leaving sensitive data directly accessible. MQTT brokers without access controls pose an additional risk, as they can be exploited not just to read device data but also to inject commands into connected IoT fleets. These data pipeline services are typically managed by engineering teams rather than security teams, meaning they often fall outside formal security asset inventories. The findings highlight a systemic gap where infrastructure critical to organisational operations is routinely left exposed due to default configurations and unclear ownership.

Why Database Schema Diagrams Become Outdated and How to Fix It

Schema diagrams frequently fall out of sync with actual databases because they are static files that no one updates after migrations run. When a developer adds or renames a column, the diagram stored in Confluence, Figma, or a repo image remains unchanged, creating a misleading source of reference. Responsibility for updating diagrams typically falls between teams, so updates are perpetually deferred. The recommended fix is to auto-generate diagrams directly from the live database on every deployment or pull request, rather than maintaining them manually. For teams wanting version control, the generated output can be committed as an SVG or Markdown file and enforced via CI checks that fail if the diagram does not match the current schema.

Developer Builds Custom Geo-fencing Engine After Google API Proved Too Imprecise

A developer building an app called Muffle — designed to automate phone sound profiles based on location and context — initially used Google's Geofencing API but abandoned it due to poor precision and unpredictable latency. The API failed to detect zone transitions accurately, sometimes delaying exit events until the user had moved several blocks away. To gain finer control, the developer switched to a custom engine built on Android's FusedLocationProviderClient, using the Haversine formula for distance calculations within a persistent Foreground Service. An adaptive polling system was implemented, reducing location update frequency when stationary and increasing it upon detected movement to conserve battery. The shift away from Google's high-level API introduced new challenges around Android's fragmented power management behavior across device manufacturers.

Framework Proposes Five Autonomy Levels to Govern AI Agents Safely in Production

A developer has published an open-source framework for governing AI agent autonomy, inspired by Garry Kasparov's 2005 observation that process quality determines outcomes more than raw capability. The framework defines five autonomy levels with sixteen controls mapped to OWASP Agentic and ISO/IEC 42001 standards, along with a scoring worksheet and promotion rules requiring evidence before granting greater autonomy. The project was motivated by a Harvard and BCG study of 758 consultants showing the same AI tool produced 40% better results within its competency range but 19 points worse results just outside it. The author argues the key question for AI deployment is no longer human versus no human, but rather how much human involvement each specific use case requires and how safety can be verified. The draft framework is publicly available on GitHub under a CC BY 4.0 license, and the author is seeking feedback from teams running agents in production to help calibrate its thresholds.

Why Organizations Must Switch to Phishing-Resistant MFA Now

Traditional multi-factor authentication methods such as SMS codes and push notifications have proven vulnerable to real-time relay and man-in-the-middle attacks, rendering them insufficient for modern security needs. Attackers can intercept or manipulate these legacy MFA mechanisms without requiring users to click a malicious link, creating a false sense of security. Phishing-resistant MFA addresses these weaknesses by cryptographically binding authentication sessions to specific domains, preventing credential reuse on spoofed sites. The two leading standards for phishing-resistant MFA are FIDO2/WebAuthn, which uses public-key cryptography and hardware or biometric authenticators, and certificate-based authentication, commonly deployed in enterprise environments. Security experts now consider migrating to these stronger protocols a critical imperative rather than an optional upgrade for organizations handling sensitive data.

How One Developer Built Procedural Web Animations as Reusable Mathematical Functions

A developer building a tool called Limot rethought web animation by treating each frame as a pure function of time and parameters rather than a fixed asset like a GIF or video. This architecture allows the same renderer to power browser previews, React or Vue components, PNG exports, and video encoding without modification. The approach relies on geometric techniques such as Fibonacci sphere distribution to place particles evenly on a 3D surface while avoiding random clustering. Depth sorting and perspective projection are then used to simulate volume and three-dimensional motion on a flat canvas. The developer also addresses uneven particle speed on curved paths by building arc-length lookup tables to maintain constant apparent velocity along parametric curves.

Beginner Coder Documents Honest Journey From Confusion to Python Basics

A beginner programmer shared their early coding experience on DEV Community, describing initial frustration with tutorial videos they could barely comprehend. To manage the confusion, they adopted a habit of pausing videos and writing down questions, no matter how basic, which helped them grasp foundational concepts like the difference between software and hardware. They then moved on to Python, which they had expected to be a near-magical all-purpose tool, only to find it more calculation- and data-focused than anticipated. Research helped them reframe Python as one instrument among many, likening it to a single tool in a carpenter's box rather than a complete solution. The writer says their next step is understanding how different programming tools work individually and in combination with one another.

Study reveals which CLAUDE.md files load at launch versus on demand in Claude Code

Researchers tested six CLAUDE.md files placed at different directory levels in Claude Code v2.1.273 to determine exactly when each file is loaded into the model's context. Files in the parent directory, working directory, and CLAUDE.local.md were all present in the very first request, each costing around 1,600 tokens. Subdirectory files were not loaded at launch but appeared later when Claude read files within those directories, at zero initial token cost. Files from directories passed via the --add-dir flag never reached the model at all unless a specific environment variable was set. The findings confirm and quantify the documented loading behavior: hierarchy-above files load at launch, subdirectory files load on demand, and --add-dir files are excluded by default.

Three-Layer Framework Proposed to Fix GA4's Blind Spots in AI Search Measurement

Google Analytics 4 captures only a fraction of traffic driven by AI assistants, making it an incomplete tool for measuring Answer Engine Optimization (AEO), according to a framework published by Search Engine Land. The model argues that AI search can shape buyer behavior before any trackable click occurs, through branded searches, direct visits, or faster sales cycles that standard last-click reports fail to attribute. To address this, the framework splits AEO measurement into three layers: direct attribution from identifiable AI referrals, influenced attribution from indirect demand signals, and a longer-term brand visibility layer. Marketers are advised to use GA4's AI Assistant channel data as a baseline floor estimate rather than a complete picture of AI-driven demand. The framework acknowledges that other factors such as seasonality, PR, and brand campaigns can affect the same metrics, so AEO signals must be evaluated in context.

Hybrid AI Agent Uses Jev for Decisions and OpenAI for Complex Reasoning

A developer has proposed a hybrid agent architecture that splits cognitive tasks between different AI systems rather than routing everything through a single large language model. In this design, code handles control flow, Jev — TypeSafe AI's decision-focused model — handles bounded choices like routing a user request to the correct workflow, and OpenAI handles open-ended reasoning tasks. Jev is described as a System One Model that takes application state as input and returns typed probabilistic decisions, rather than generating free-form text. The architecture is motivated by the observation that not every agent decision requires general-purpose language generation, and that using a purpose-built decision model can reduce unnecessary LLM calls. The approach distinguishes between bounded decisions, such as identifying which support workflow fits a request, and open-ended problems that genuinely require flexible reasoning.

Vinkius Connects AI Agents to Bright Data Web Scraping via MCP Framework

A platform called Vinkius has launched a Bright Data connector designed to give AI agents direct, governed access to large-scale web scraping and proxy infrastructure. Built on MCPFusion, an open-source TypeScript framework, the integration allows agents to perform real-time data gathering tasks such as market research and competitive analysis without developers manually managing scrapers or API credentials. The connector uses a single gateway token model, eliminating credential sprawl and reducing security risks associated with giving large language models unrestricted API access. All agent operations run inside isolated V8 sandboxes enforcing eight governance policies, including SSRF prevention and audit logging. The system supports both synchronous web requests for lighter tasks and an asynchronous pipeline for high-volume jobs such as scraping thousands of LinkedIn or Amazon pages.

NFS Storage Triggers I/O Failures in Air-Gapped Kubernetes Cluster

A self-managed Kubernetes cluster operating in an air-gapped private datacenter is facing critical storage failures due to its sole reliance on NFS as the primary StorageClass. Applications like Elasticsearch and Camunda's Zeebe engine require POSIX semantics — including atomic rename, fsync, and file locking — which NFS cannot reliably provide because of its stateless protocol and network latency. These limitations cause race conditions, data inconsistencies, and write amplification that degrade cluster reliability. Local storage alternatives such as Longhorn are ruled out because Elasticsearch data already exceeds the 100GB SSD capacity of each server, while cloud-based block storage options are unavailable in the isolated environment. The DevOps team must transition to a block storage solution that satisfies POSIX requirements to prevent continued data integrity risks and potential downtime.

Developer Builds Interactive Fashion Hero Section Using HTML, CSS, and GSAP

A frontend developer has created an experimental web project called NOIR//FORM — AFTER DARK, designed to mimic an interactive digital magazine rather than a standard ecommerce landing page. The project was built entirely with HTML, CSS, JavaScript, and GSAP, without any frameworks like React. It features cinematic fashion photography, editorial typography, brutalist design elements, and GSAP-powered entrance animations. The mobile version was treated as a separate art direction exercise rather than a simple scaled-down adaptation of the desktop layout. The developer shared the work on DEV Community to gather feedback from other frontend developers and designers on the interaction and visual direction.